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Remarks 

Claims 1-7, 9, 12-35 and 37-41 are currently pending in the subject application and are 
presently under consideration. Claims 1,19, 29, 40 and 41 have been amended herein. Claim 1 
has been amended to recite limitations previously recited in dependent claims 8, 10, and 11; and 
claim 29 has been amended to recite the previous limitations of dependent claim 36. Claims 8, 

10, 1 1 and 36 have been cancelled herein. A listing of all claims can be found at pages 2-8. 

The below comments present in greater detail distinctive features of applicants' claimed 
invention over the cited art that were conveyed to the Examiner over the telephone on March 6, 
2008. Favorable reconsideration of the subject patent application is respectfully requested in 
view of the comments and amendments herein. 

I. Rejection of Claims 1-39 and 41 Under 35 U.S.C. $101 

Claims 1-39 and 41 stand rejected under 35 U.S.C. §101 because the claimed invention is 
directed to non-statutory subject matter. This rejection should be withdrawn for at least the 
following reasons. Independent claim 1 (from which claims 2-18 depend) has been amended to 
recite a computer readable storage medium. Independent claim 19 (from which claims 20-28 
depend) has been amended to recite a system embodied on a computer readable storage medium 
that facilitates extracting data in connection with spam processing. Independent claim 29 (from 
which claims 30-39 depend) has been amended herein to recite a computer-readable storage 
medium that performs a method that facilitates spam detection and prevention. Independent 
claim 41 has been amended herein to recite a system embodied on one or more computers that 
facilitates extracting data in connection with spam processing. It is believed that the 
amendments to the independent claims address the Examiner's concerns with respect to the 
subject claims. Accordingly, it is requested that this rejection be withdrawn. 

11. Rejection of Claims 1-41 Under 35 U.S.C. §103(a) 

Claims 1-41 stand rejected under 35 U.S.C. § 103(a) as being unpatentable over Glass 
(U.S. 2005/0060643) in view of Kephart (U.S. 6,732,149). This rejection should be withdrawn 
for at least the following reasons. Neither Glass nor Kephart, alone or in combination, teach or 
suggest all claim limitations, as discussed in detail below. 
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Claims 1-18 and 40: 

The subject application relates to identifying legitimate mail and undesired mail and for 
extracting message features particular to spam to facilitate spam prevention. (See e.g., pg. 1, Ins. 
4-6.) Further, the subject application can identify disguised spam messages by examining 
portions of the messages. (See e.g., pg. 2, Ins. 12-17.) The messages can include electronic mail 
and/or electronic messaging of any form that can be distributed over a suitable communication 
architecture. (See e.g., pg. 6, Ins. 16-24.) 

Independent claim 1 (from which claims 2-18 depends) recites a system that facilitates 
extracting data in connection with spam processing, comprising ...an analysis component that 
at least examines ...a content type of the message for spam..., wherein the content type is 
case-sensitive, comprises a primary content-type and a secondary-content type, or 
combinations thereof. 

Independent claim 40 recites a computer-readable medium having stored thereon the 
following computer executable components: a component that receives a message and extracts a 
set of features associated with some part, content or content type of a message, wherein at least 
one content type is case-sensitive, comprises primary content-type and a secondary-content 
type, or combinations thereof. 

In an example, when the content-type feature is case-sensitive a "Text/HTML" type is 
different from a "text/html" type and, thus, "html" and "HTML" can be used as two separate 
features to facilitate differentiating spam from non-spam messages . (See e.g., pg. 14, Ins. 23-27 
and pg. 18, Ins 8-10.) Examining a content type for a primary content-type and a secondary- 
content type (e.g., MIME content-types), can identify messages that are forged or misrepresented 
to make the message appear to be non-spam. (See e.g., pg. 3, Ins. 16-23; pg. 9, Ins. 6-12; pg. 10, 
Ins. 23-24; pg. 14, Ins. 4-6; and pg. 18, Ins. 1-4.). Further, content-type can be case-sensitive to 
more accurately capture variations in content-type notation provided by message sending 
applications, including those used by spammers,. (See e.g., pg. 3, Ins. 23-25 and pg. 9, Ins. 12- 
14.) Neither of the cited references teach or suggest such novel features. 

Glass et al. relates to comparing documents to determine a highest level of resemblance 
between an unclassified document and any of a set of previously classified documents. Glass et 
al. discusses preprocessing of documents to aid in matching purposes and to alter the document, 
such as by altering letters to a common format ("such as lower case") so that similarity detection 
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between the documents is not hindered. (See e.g., Tf[01 19]). However, this preprocessing is not 
examining a content type (e.g., case-sensitive) of the message for spam; it is simply to place the 
documents in a similar format for comparison. Furthermore, Kephart is silent regarding a 
content type that is case-sensitive, thus, even if combined with Glass et al, the combination does 
not teach or suggest all claim limitations. 

Further, Glass et al. discusses message delivery attributes such as message header format, 
sender address content patterns, recipient address content patterns, invalid dates, attached files, 
and subject line patterns. (See e.g., t[0049] through ^([0056]). Kephart discusses a HashBlock, 
which is defined as a block of data computed from the body of the archetype and used to 
measure overall similarity to other messages, and how to transform the message to compute the 
HashBlock data. (See e.g., col. 10, In. 67 to col. 11, Ins. 3.) However, neither Glass et al. nor 
Kephart teach or suggest a content type that comprises a primary content-type and a secondary- 
content type, as claimed. 

Based on at least the above, neither of the cited references, alone or when combined, 
teach or suggest all claim limitations. Accordingly, this rejection should be withdrawn and the 
subject claims allowed. 

Claims 19-41: 

Independent claim 19 (from which claims 20-28 depends) recites a system embodied on a 
computer readable storage medium that facilitates extracting data in connection with spam 
processing, comprising a component that receives an item and extracts a set of features 
indicative of spam associated with a message, at least one of the features is a normalized time 
delta. 

Independent claim 29, from which claims 30-39 depend, recites a method comprising 
receiving a plurality of messages ..determining time stamps associated with the message; and 
determining a delta between a first time stamp and a last time stamp, the first time stamp being 
located in a Received header and the last time stamp being located in a Date header at the 
message's destination. 

Independent claim 40 recites a computer-readable medium having stored thereon the 
following computer executable components ... a component that determines a delta between a 
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first time stamp and a last time stamp associated with the message, the first time stamp and the 
last time stamp are normalized to a coordinated universal time. 

Independent claim 41 recites a system ... that facilitates extracting data in connection 
with spam processing comprising ... means for determining a delta between a first time stamp 
and a last time stamp associated with the message, the first time stamp and the last time stamp 
are normalized to a coordinated universal time. 

The set of features indicative of spam distinguish spam messages from legitimate or good 
messages. The time delta is a difference between the timestamp in a first Received header {e.g., 
first server to accept the message and begin delivery to the next hop) and a "Date:" header (when 
the message was actually received for delivery to the recipient), which represents an end-to-end 
delivery time for the message. {See e.g., pg. 4, Ins. 3-7.). The time delta is normalized to 
coordinated universal time (UTC). {See e.g., id.). For example, most non-spam messages can be 
or are delivered in less than an hour; whereas, most spam can appear to have taken several hours 
or even days to reach their destinations. {See e.g., id. at Ins. 7-9.) The cited references do not 
teach or suggest such novel features. 

Glass et al. discusses detecting messages with "invalid dates, such as 12 hours ahead of 
the current time at the mail receiving location". {See e.g., ^[[0054].) Thus, Glass et al. teaches 
detecting messages that appear to have been received before they were sent {e.g., 12 hours 
ahead). Kephart discusses pruning signature databases utilizing a time when a copy was 
originally received, comparing it with a current time, and removing a signature cluster based on a 
comparison between the receive time and a predetermined data and time. {See e.g., col. 7, Ins. 
35-41 and col. 14, Ins. 34-39.) However, neither Glass et al. nor Kephart teach or suggest all 
elements recited in the independent claims. 

Based on at least the above, the combination of the cited references (or when applied 
separately) does not teach nor suggest all claim limitations. Accordingly, it is requested that this 
rejection be withdrawn and the subject claims allowed. 
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Conclusion 

The present application is believed to be in condition for allowance in view of the above 
comments and amendments. A prompt action to such end is earnestly solicited. 

In the event any fees are due in connection with this document, the Commissioner is 
authorized to charge those fees to Deposit Account No. 50-1063 [MSFTP573US]. 

Should the Examiner believe a telephone interview would be helpful to expedite 
favorable prosecution, the Examiner is invited to contact applicants' undersigned representative 
at the telephone number below. 



Respectfully submitted, 
Amin, Turocy & Calvin, llp 



/Himanshu S. Amin/ 
Himanshu S. Amin 
Reg. No. 40,894 



Amin, Turocy & Calvin, llp 
24 th Floor, National City Center 
1900 E. 9 th Street 
Cleveland, Ohio 44114 
Telephone (216) 696-8730 
Facsimile (216) 696-8731 
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